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Amendments to the Claims: 

This listing of claims replaces all prior versions and listings of claims in the application: 
Listing of Claims : 

1 . (Previously Presented) A method of identifying unwanted messages, the method 
comprising: 

inspecting a payload portion of a message being communicated and identifying 
characteristics of the payload portion; 

comparing the characteristics of the inspected payload portion of the message with stored 
data indicating characteristics of at least one other message that has been inspected; 

based on comparison results, identifying a security condition from among at least one of 
acceptable, unacceptable, and indeterminate states; and 

processing the message based on the security condition, wherein processing the message 
includes: 

rejecting the message if the security condition associated with the message 
reflects the unacceptable state; 

accepting the message if the security condition associated with the message 
reflects the acceptable state; and 

if the security condition associated with the message reflects the indeterminate 
state, monitoring the message by: 

tracking a location of the message; 

inspecting at least one other message subsequent to the processing of the 
message; 

updating the stored data to indicate characteristics of the at least one other 
message that has been inspected; 

recategorizing the security condition of the message based on the updated 
stored data; and 
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reprocessing the message based on the security condition. 

2. (Original) The method of claim 1 wherein the characteristics of the payload 
portion include information other than address information. 

3. (Original) The method of claim 2 wherein the characteristics of the payload 
portion do not include address information. 

4. (Original) The method of claim 1 wherein the message includes an electronic mail 
message. 

5. (Cancelled). 

6. (Previously Presented) The method of claim 5 wherein the security condition 
associated with a message is identified as reflecting the unacceptable state when the comparison 
of the characteristics reveals a threshold number of messages having a shared characteristic. 

7. (Previously Presented) The method of claim 6 wherein reprocessing the message 
based on the security condition includes remo ving the message if the security condition 
associated with the at least one other message inspected subsequent to the processing of the 
message is identified as reflecting the unacceptable state and the at least one other message has 
characteristics in common with the message. 

8. (Previously Presented) The method of claim 1 further comprising tracking the 
characteristics of the payload portion for comparison against characteristics of future messages, 
wherein the characteristics of a new message are compared with the characteristics of at least one 
message that has been tracked. 
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9. (Previously Presented) The method of claim 8 wherein comparing the 
characteristics of the payload portion includes comparing the characteristics of the payload 
portion of messages inspected with stored characteristics of other communicated messages. 

10. (Previously Presented) The method of claim 8 wherein the characteristics of the 
payload portion of a message are tracked when the security condition is identified as reflecting 
the indeterminate state. 

1 1 . (Currently Amended) The method of claim 10 wherein an indeterminate state is 
identified if the comparison of the characteristics does not itself reveal an unacceptable state , but 
the characteristics of the payload portion would reveal the unacceptable state in combination 
with similar characteristics of other messages. 

12. (Previously Presented) The method of claim 10 further comprising accepting the 
message if the security condition associated with the message reflects the indeterminate state. 

13. (Cancelled). 

14. (Original) The method of claim 1 wherein identifying the security condition 
includes comparing the characteristics of more than one message received by a single device. 

15. (Original) The method of claim 1 wherein identifying the security condition 
includes comparing the characteristics of more than one message sent by a single device. 



16-29. (Cancelled). 



30. (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message includes identifying the security condition as reflecting the acceptable 
state. 
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3 1 . (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message includes identifying the security condition as reflecting the 
unacceptable state. 

32. (Previously Presented) The method of claim 1 wherein identifying the security 
condition as reflecting the acceptable state includes identifying the security condition as 
reflecting a neutral state. 

33. (Previously Presented) The method of claim 1 wherein identifying the security 
condition as reflecting the unacceptable state includes identifying the security condition as 
reflecting a hostile state. 

34. (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message is performed when the stored data is updated such that the security 
condition associated with a message with certain characteristics would be identified as reflecting 
a state other than the indeterminate state and the security condition associated with the message 
with the same characteristics would have been identified as reflecting the indeterminate state 
prior to the update. 

35. (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message is performed if at least one other message inspected subsequent to the 
processing of the message includes a characteristic that increases the number of messages 
inspected with that characteristic above a threshold level. 



36-37. (Cancelled). 
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38. (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message is performed when an administrator updates the stored data to indicate 
that at least one characteristic of a message is acceptable. 

39. (Previously Presented) The method of claim 1 wherein recategorizing the security 
condition of the message is performed when an administrator updates the stored data to indicate 
that at least one characteristic of a message is unacceptable. 

40. (Currently Amended) The method of claim 1 wherein reprocessing the message 
includes removing the message from storage if the security condition includ e s reflects the 
unacceptable state. 

41 . (Previously Presented) The method of claim 1 wherein reprocessing the message 
includes generating an alarm if the security condition reflects the unacceptable state. 

42. (Previously Presented) The method of claim 1 wherein reprocessing the message 
includes continuing to track the location of the message if the security condition still reflects the 
indeterminate state. 

43. (Previously Presented) The method of claim 1 wherein recategorizing the message 
includes: 

accessing the location of the message; 
retrieving the message from the location; 

inspecting the payload portion of the message and identifying characteristics of the 
payload portion; 

comparing the characteristics of the payload portion of the message with the updated 
stored data; and 

in response to comparing, identifying the security condition from among at least one of 
the acceptable, unacceptable, and indeterminate states. 
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44-51. (Withdrawn). 



